Regarding Rise of Unauthorized Access and Password Security

[Gokulo]

i lost about 60m gil and couldn't recover anything thanks to their "photo ID or gtfo" policy since i am not the original owner. sometimes i really wish i was a con artist to fake an ID... it seems being honest doesn't always pay off. i manage to prove my ownership everytime on chat support but when it comes to recovering data, i can't do shit just because i don't have an ID with the name of original owner on it.

You know that's basically how it works almost everywhere else too?

[orson]

Changing passwords is and always will be a bandaid. Most sites have anti-brute force measures so that you can't have someone guess your password. If your password got hacked it was due to a security problem on the website or more than likely you got keylogged. Get antivirus and run firefox with adblock and no scripts.

Probably the other reason there have been so many hacks is the multiple account usage. I bet a lot of people that use secondary accounts don't bother using an authenticator either because it's a shared account or they just can't be bothered to buy one for their friends' old accounts.

[Septimus]

Changing passwords is and always will be a bandaid. Most sites have anti-brute force methods so that you can't have some one guess your password. If your password got hacked it was due to a security problem on the website or more than likely you got keylogged. Get antivirus and run firefox with adblock and no scripts.

Probably the other reason there have been so many hacks is the multiple account usage. I bet a lot of people that use secondary accounts don't bother using an authenticator either because it's a shared account or they just can't be bothered to buy one for their friends' old accounts.

Ad Block, No Script, and Flash Block are the first three things I install after Firefox. Please, everyone for your own good learn to love them.

[zagex]

You can unlink your token, but it's a one-time affair. You'd have to purchase another token to resecure the account.

When I misplaced my token, I had to get SE to disable it. They said they would re-enable it when I found it. That was a while ago, and I didn't tell them I found it (a year later), but I assume I can still enable it.

[Vinedrai]

You know that's basically how it works almost everywhere else too?

yes, i am aware of that but my point is; if we can prove our ownership for everything else without a photo ID, why are we forced to provide it for character data recovery? i can recover an item that i mistakingly dropped/sold to a vendor, i can transfer my character, i can reset my pol password etc etc but once i am hacked, there is nothing i can do about it on my own. for example, if a hacker gets access to my account management page and say, i have enough crysta on the account to allow a transfer, they can transfer the character to another server without a photo ID but apparently, i wouldn't be able to reverse it without a photo ID which the hacker wouldn't have needed to have in the first place to do the transfer.

edit: i also got them to freeze and unfreeze my account without a photo ID... if they were that cautious about my ownership, they wouldnt at least let me unfreeze the account...

[Alolbont]

I keep nothing of value on my second account that is passed around amongst friends. Everything is rare/ex or I augmented it so it cant be sold.

[Apelila]

If I remember right, when you setup an account there's no big gigantic warning that says "Hey asshole, put the right name on this or you'll never get the account back ever".

If my second account ever gets hacked, I'm fucked. I've been paying for it since it was created but because it was my boyfriend at the times, his name is on it(he was going to take over payments). Can't get a dead person's ID.

So yeah, the requirements for getting something back are a bit bullshit.

[Crab_Cake]

If I remember right, when you setup an account there's no big gigantic warning that says "Hey asshole, put the right name on this or you'll never get the account back ever".

If my second account ever gets hacked, I'm fucked. I've been paying for it since it was created but because it was my boyfriend at the times, his name is on it(he was going to take over payments). Can't get a dead person's ID.

So yeah, the requirements for getting something back are a bit bullshit.

Agreed. They should do the "whoever paid the most" wins route.

Lets say someone other than you pays or play the game first but after a month or so you get the account but have changed the billing/CC to your info. You have paid for over 5 years.

In this scenario they should just ask for Photo ID of whoever has been paying for 5 years.

I know they want to prevent people from stealing accounts so the solution is they could give the person maybe a two year grace period (after the CC changes) to dispute it if that happens.

If a person takes longer than two years to dispute it, whoever the billing info has been used during the time period will take priority for obtaining back accounts.

Also SE can't use the RMT excuse either - Since there is a 2 year grace period for the original owner to dispute/get their account back that means the seller is still capable of just obtaining their account back (meaning buyer beware still).

This will screw over people who got hacked a long time ago (and never tried to recover it) but that doesn't happen too often and they don't have to implement it retroactively (could start now).

[Septimus]

This is why when I decided that I wanted a second character, I started Atum from scratch. No one can ever claim ownership, he has always been in my name and with the same credit card. And I leveled Atum back when it sucked to XP. (There wasn't even a Greater Colibri camp back then. It must be super simple to level up a second now that XP flows like water.)

[Apelila]

Shit I level Fynecia back then too. My WHM hit 75 before my main did, thanks to NIN becoming the preferred Xp tank over Paladin after I hit 60.
Completing CoP x2 before the 'easy mode' patch is one of my greatest accomplishments in game. Though I never did Promies on 'Hard mode', thank god.

Back on topic, I still have both the original original code books for the game. Are they really requiring a photo ID in the face of having those? Edit: Not that I'm getting hacked anytime soon. 2nd character isn't even active right now, go go saving money for a few months while I focus on leveling fishing/doing other things in life.

[Vinedrai]

Back on topic, I still have both the original original code books for the game. Are they really requiring a photo ID in the face of having those? Edit: Not that I'm getting hacked anytime soon. 2nd character isn't even active right now, go go saving money for a few months while I focus on leveling fishing/doing other things in life.

yes, they do require a photo ID regardless :/ i got the same answer both from the chat support and the staff responsible for hacked account operations ([email protected] if anyone is wondering how to reach them directly).

[Shenrien]

*** Temporary Suspension of "SQUARE ENIX MEMBERS" Operations ***


We have reason to believe that unknown parties may have gained unauthorized access to a particular Square Enix server related to the free SQUARE ENIX MEMBERS service offered in North America and Japan. In response, Square Enix, Inc. has temporarily suspended operation of the SQUARE ENIX MEMBERS service starting at 10PM (PST) on December 12, 2011.


We are assessing the full extent of this potential breach to determine what data, if any, was compromised and will provide more details as soon as possible. While some personal information may have been accessed, we can confirm that there is no possibility of any credit card information leak from this incident, since the server in question stores no credit card information. We estimate that the suspension will continue for a few days until we complete our investigation and counter-measures. We will update you as we learn more.


We sincerely apologize for any inconvenience caused by the temporary suspension of the SQUARE ENIX MEMBERS service. We take data security extremely seriously and we regret any inconvenience this may have caused our customers and fans. We appreciate your patience and support at this time.

http://release.square-enix.com/na/2011/12/13_01.html

another mule of our shell got hacked, this one holding all our AV pops \o\ fuck yeah!

[Airenn]

I have deduced that whomever owns your mules is retarded.

[Necronus]

Dear Square Enix Member,

You are receiving this email because Square Enix detected a limited server intrusion on December 12, 2011, and temporarily suspended the US/JP editions of the SQUARE ENIX MEMBERS service in order to conduct an investigation.

Based on our investigation, we have found no evidence at this point that any personal information was accessed. User login credentials and credit card information are not stored on the affected server. We are continuing to investigate.

We sincerely apologize for any inconvenience caused by the temporary suspension of the SQUARE ENIX MEMBERS service. We take data security extremely seriously and we regret any inconvenience this may have caused our customers and fans. We appreciate your patience and support at this time as we finalize our investigation in the next few days.

Any updates will be posted on our corporate website at: http://www.square-enix.com/na/

Sincerely,

SQUARE ENIX

I received a slightly different letter yesterday, but I don't seem to have been hacked. As you can see, they seem to have come to the same conclusion. Did anyone else get a letter like this? Perhaps they tried to brute force accounts? (I use the security token, and I'm sure my computer is clean). Either way I haven't been on FFXI in weeks so I never noticed the account get locked and I can log in fine today.

[Trigun]

I've been getting these but for WoW.

I only tried WoW for like 2 months, many, many years ago.

Someone bad got the email list.

[Gokulo]

Uhh, that's a genuine letter from S-E, not the usual scam stuff. They've been hacked not long ago and are just saying sorry to the players. Though, like they said, it doesn't seem like anyone was really affected by that.

[Septimus]

I've been getting these but for WoW.

I only tried WoW for like 2 months, many, many years ago.

Someone bad got the email list.

I can top that. I keep getting letters from WoW and I never even touched the game. People love using my e-mail address to sign up to things. >_>

[Necronus]

Oh, I knew it wasn't fake Gokulo, was just wondering if a lot of people got the letter and to just double check that I was fine.

And Trigun and Septimus, I know the feeling. I played Runescape like .. 7 years ago .. and someone recently got the e-mail list or something, because I've suddenly been flooded with "Your Runescape account has been hacked" e-mails, with various links to phishing websites. So annoying.

[Septimus]

Oh, I knew it wasn't fake Gokulo, was just wondering if a lot of people got the letter and to just double check that I was fine.

And Trigun and Septimus, I know the feeling. I played Runescape like .. 7 years ago .. and someone recently got the e-mail list or something, because I've suddenly been flooded with "Your Runescape account has been hacked" e-mails, with various links to phishing websites. So annoying.

I think that they are genuine WoW missives, but I never played the game. (I never even considered playing the game- FFXI will be my first, last, and only MMO.) For some reason people who aren't me like to sign up to different things with my e-mail, I got messages from Twitter and Facebook about my new account years ago; I never bothered with them because, well, fuck Twitter and Facebook.

I also just got an e-mail about the intrusion to the Square-Enix account thing. As well as a letter inviting me to a free trial of Final Fantasy XI, a game that I have obviously never played or even heard of. (I guess that they don't even even cross-reference their data to notice when people have FFXI accounts linked to their S-E profiles, let alone my two.)

[Crab_Cake]

Oh, I knew it wasn't fake Gokulo, was just wondering if a lot of people got the letter and to just double check that I was fine.

admin: Link removed due to new policy

I got the email too. Fortunately though it seems no password or login data or anything were accessed.

According to SE:

As a result of our continuing investigation into the unauthorized intrusion reported yesterday, Square Enix has now determined that user login credentials were not accessed. Moreover, we have not found evidence that the individual was able to access any personal information at all.

We will be sending an email to all SQUARE ENIX MEMBERS advising that an incident took place. This email will not be requesting any action from you.

We have reported this incident to the Japanese Government.

Because we have decided to conduct a broader internal investigation, it will take a few more days before we make the SQUARE ENIX MEMBERS service available once again. We deeply regret the inconvenience this may have caused our customers and fans, and appreciate your patience.

So if the bold is true, nothing too bad fortunately.